general protection fault in open_fs

general protection fault in open_fs_devices
Status: fixed on 2018/08/28 17:48
Reported-by: syzbot+909a5177749d7990ffa4@syzkaller.appspotmail.com
Fix commit: 81ffd56b btrfs: fix mount and ioctl device scan ioctl race
First crash: 778d, last: 746d

Sample crash report:

BTRFS: device fsid ecf6f2a2-2997-48ae-b81e-1b00920efd9a devid 0 transid 0 /dev/loop0
print_req_error: I/O error, dev loop1, sector 128
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
CPU: 0 PID: 4585 Comm: syz-executor809 Not tainted 4.18.0-rc1+ #108
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:open_fs_devices+0x7f0/0xc80 fs/btrfs/volumes.c:1124
Code: 48 8b 85 e0 fe ff ff 41 c7 87 14 01 00 00 01 00 00 00 48 8d b8 a0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 ab 03 00 00 48 8b 85 e0 fe ff ff 49 8d 7f 50 48 
RSP: 0018:ffff8801d8fa71d8 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffffff82ca7517
RDX: 0000000000000014 RSI: ffffffff82ca7525 RDI: 00000000000000a0
RBP: ffff8801d8fa7348 R08: ffff8801d8bc8540 R09: ffff8801d8fa7240
R10: ffffed003b1f4e5c R11: ffff8801d8fa72e7 R12: ffff8801d8880d58
R13: ffff8801d8880cd8 R14: dffffc0000000000 R15: ffff8801d8880c80
FS:  0000000001c9a880(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000625208 CR3: 00000001d8a45000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 btrfs_open_devices+0xc0/0xd0 fs/btrfs/volumes.c:1155
 btrfs_mount_root+0x942/0x1e90 fs/btrfs/super.c:1568
 mount_fs+0xae/0x328 fs/super.c:1277
 vfs_kern_mount.part.34+0xdc/0x4e0 fs/namespace.c:1037
 vfs_kern_mount+0x40/0x60 fs/namespace.c:1027
 btrfs_mount+0x4a9/0x215e fs/btrfs/super.c:1661
 mount_fs+0xae/0x328 fs/super.c:1277
 vfs_kern_mount.part.34+0xdc/0x4e0 fs/namespace.c:1037
 vfs_kern_mount fs/namespace.c:1027 [inline]
 do_new_mount fs/namespace.c:2518 [inline]
 do_mount+0x581/0x30e0 fs/namespace.c:2848
 ksys_mount+0x12d/0x140 fs/namespace.c:3064
 __do_sys_mount fs/namespace.c:3078 [inline]
 __se_sys_mount fs/namespace.c:3075 [inline]
 __x64_sys_mount+0xbe/0x150 fs/namespace.c:3075
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x446fca
Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 1d aa fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 fa a9 fb ff c3 66 0f 1f 84 00 00 00 00 00 
RSP: 002b:00007ffee8ad8698 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffee8ad86b0 RCX: 0000000000446fca
RDX: 00007ffee8ad86b0 RSI: 00000000200000c0 RDI: 00007ffee8ad86d0
RBP: 0000000000000001 R08: 00007ffee8ad8710 R09: 000000000000000a
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000001
Modules linked in:
Dumping ftrace buffer:
   (ftrace buffer empty)
---[ end trace 9f351a86bc83ada4 ]---
RIP: 0010:open_fs_devices+0x7f0/0xc80 fs/btrfs/volumes.c:1124
Code: 48 8b 85 e0 fe ff ff 41 c7 87 14 01 00 00 01 00 00 00 48 8d b8 a0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 ab 03 00 00 48 8b 85 e0 fe ff ff 49 8d 7f 50 48 
RSP: 0018:ffff8801d8fa71d8 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffffff82ca7517
RDX: 0000000000000014 RSI: ffffffff82ca7525 RDI: 00000000000000a0
RBP: ffff8801d8fa7348 R08: ffff8801d8bc8540 R09: ffff8801d8fa7240
R10: ffffed003b1f4e5c R11: ffff8801d8fa72e7 R12: ffff8801d8880d58
R13: ffff8801d8880cd8 R14: dffffc0000000000 R15: ffff8801d8880c80
FS:  0000000001c9a880(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000625208 CR3: 00000001d8a45000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (8):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	Maintainers
ci-upstream-kasan-gce-root	2018/06/18 22:53	upstream	9ffc59d5	45c54f75	.config	log	report	syz	C	clm@fb.com, dsterba@suse.com, jbacik@fb.com, linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org
ci-upstream-kasan-gce-root	2018/06/06 10:30	upstream	af6c5d5e	41f9540d	.config	log	report	syz	C	clm@fb.com, dsterba@suse.com, jbacik@fb.com, linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org
ci-upstream-kasan-gce-root	2018/07/08 08:37	upstream	b2d44d14	c9a7a4dc	.config	log	report			clm@fb.com, dsterba@suse.com, jbacik@fb.com, linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org
ci-upstream-kasan-gce-root	2018/07/07 12:30	upstream	29119529	6c0c0099	.config	log	report			clm@fb.com, dsterba@suse.com, jbacik@fb.com, linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org
ci-upstream-kasan-gce-root	2018/07/06 06:14	upstream	c42c12a9	d3b2a0e2	.config	log	report			clm@fb.com, dsterba@suse.com, jbacik@fb.com, linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org
ci-upstream-kasan-gce-root	2018/06/28 12:07	upstream	f5749432	dba0b50e	.config	log	report			clm@fb.com, dsterba@suse.com, jbacik@fb.com, linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org
ci-upstream-kasan-gce-root	2018/06/09 15:22	upstream	7d3bf613	866118af	.config	log	report			clm@fb.com, dsterba@suse.com, jbacik@fb.com, linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org
ci-upstream-kasan-gce-root	2018/06/06 10:39	upstream	af6c5d5e	41f9540d	.config	log	report			clm@fb.com, dsterba@suse.com, jbacik@fb.com, linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org